# Two-factor authentication and passkeys
Sign-in runs through Keycloak at auth.zerolog.ch, ZeroLog's own sign-in service in Switzerland.
**Four factors** you choose
- **Password**: The classic. Optional once another factor is enabled.
- **Email**: A one-time code or a magic link sent to your verified address. Codes and links are kept in server memory only; ZeroLog sends the mail through SMTP2GO.
- **Authenticator app**: A six-digit TOTP code from any authenticator app.
- **Passkey**: WebAuthn: your device's own unlock (fingerprint, face or PIN).
## Set up a factor
Settings *โ* Sign-in & security *โ* Set up factors & email
1. *01*
The link opens your Keycloak account page.
2. *02*
Add an email address, an authenticator app or a passkey there.
3. *03*
Back in ZeroLog, the factor shows as **Ready**. A factor that is not set up stays greyed out and cannot be switched on. Email counts as ready once the address is verified.
## Choose the rules
Settings *โ* Sign-in & security
Each factor has two switches. **Enabled** means it can be used to sign in. **Required** means it is asked for at every sign-in.
Pick a **preferred login** from the enabled factors; it is preselected at sign-in. Every sign-in asks for the method you choose plus all required factors.
To save, ZeroLog first asks you to confirm your sign-in (the button reads **Sign in to confirm**), then the button reads **Save rules**. The new rules apply from your next sign-in.
If you already had an authenticator app set up, your starting rules are password plus authenticator code, both required, until you change them.
## Passwordless
After you enable another factor, you can turn on **Passwordless**. The password is then no longer used to sign in.
## Passkeys
Nothing typeable is exchanged.
That is what makes a passkey resistant to phishing in a way a code is not.
Register more than one if you can: a laptop and a phone, say.
- Laptop
- Phone
A passkey lives on the device that made it, and a single passkey plus a lost device is a bad afternoon.
## From setting up a factor to the next sign-in
Mermaid source of the diagram on this page:
```mermaid
%% MFA: from setting up a factor to the next sign-in. Facts from server/account-security.js, server/routes/account-security.js, web account-security-panel.tsx.
flowchart TB
a["1. Set up a factor on the
Keycloak account page
(email, authenticator, passkey)"]
b["2. Factor shows Ready
in Sign-in & security"]
c["3. Per factor: switch
Enabled and Required
Pick a preferred login"]
p["Optional: Passwordless
(needs another factor)"]
d["4. Confirm your sign-in,
then Save rules"]
e["5. Rules stored with
your Keycloak account"]
f["6. Next sign-in: the method
you choose plus every
required factor"]:::hot
x["Not set up:
cannot be switched on"]
a --> b --> c --> d --> e --> f
c -.-> p
p -.-> d
a -.-> x
classDef hot stroke:#8f7ac9
```